78 matches found
CVE-2023-23700
CVE-2023-23700 affects the OceanWP WordPress theme (versions
PT-2024-4727 · Microsoft · Net Core
Name of the Vulnerable Software and Affected Versions: Сервис оправдательных документов affected versions not specified Description: The issue is related to incorrect restriction of directory path names in the .NET Core component of the "Сервис оправдательных документов" software. Exploitation of...
PT-2024-6875
Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.5 Description The issue is a path traversal affecting the Faces Mojarra component within Ivanti Avalanche. This allows a remote, unauthenticated attacker to potentially reveal sensitive information. The...
CVE-2024-3025
The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...
CVE-2024-29905 DIRAC: Unauthorized users can read proxy contents during generation
DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process e.g., when using dirac-proxy-init, it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then...
CVE-2024-1303
Incorrectly limiting the path to a restricted directory vulnerability in Badger Meter Monitool that affects versions up to 4.6.3 and earlier. This vulnerability allows an authenticated attacker to retrieve any file from the device using the download-file functionality...
The vulnerability of the bhyveload utility in FreeBSD operating systems allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the bhyveload module in FreeBSD is related to an incorrect limitation on the path name to the host-path directory with restricted access. Exploiting this vulnerability allows a remote attacker to gain unauthorized access to protected information by loading a specially crafted...
CVE-2023-50386
Improper Control of Dynamically-Managed Code Resources, Unrestricted Upload of File with Dangerous Type, Inclusion of Functionality from Untrusted Control Sphere vulnerability in Apache Solr.This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.4.1. In the affected...
PT-2024-2152
Name of the Vulnerable Software and Affected Versions X-Rite MAT 6 Kohinoor affected versions not specified Description The issue is related to incorrect restriction of a directory path name with limited access in the X-Rite MAT 6 Kohinoor embedded spectrophotometer software. Exploitation of this...
CVE-2023-5907
The File Manager WordPress plugin before 6.3 does not restrict the file managers root directory, allowing an administrator to set a root outside of the WordPress root directory, giving access to system files and directories even in a multisite setup, where site administrators should not be allowe...
Path traversal
A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiSandbox version 4.4.0 and 4.2.0 through 4.2.5 and 4.0.0 through 4.0.3 and 3.2.0 through 3.2.4 and 2.5.0 through 2.5.2 and 2.4.1 and 2.4.0 allows attacker to denial of service via crafted http requests...
PT-2023-5467
Name of the Vulnerable Software and Affected Versions Ansible affected versions not specified Description A path traversal issue exists when Ansible extracts tarballs, allowing an attacker to craft a malicious tarball. This could result in a symlink being dropped on the disk when using the galaxy...
Important: rust
Issue Overview: Cargo downloads the Rust project's dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files...
PT-2023-5571 · Siemens · Siemens Software Center
Name of the Vulnerable Software and Affected Versions: Siemens Software Center versions prior to V3.0 Description: A DLL Hijacking issue could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path. This is relat...
Path traversal
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Bullwark allows Path Traversal.This issue affects Bullwark: before BLW-2016E-960H...
PT-2023-3802 · Sonicwall · Sonicwall Gms +1
Name of the Vulnerable Software and Affected Versions: SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier Description: The issue is caused by incorrect restriction of directory path names with limited access. This allows an authenticated attacker to...
Path traversal
An improper limitation of a pathname to a restricted directory 'Path Traversal' vulnerability CWE-22 in FortiExtender management interface 7.0.0 through 7.0.3, 4.2.0 through 4.2.4, 4.1.1 through 4.1.8, 4.0.0 through 4.0.2, 3.3.0 through 3.3.2, 3.2.1 through 3.2.3, 5.3 all versions may allow an...
Path traversal
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could allow an attacker to create arbitrary shares on arbitrary directories and exfiltrate sensitive files, passwords, users and device configurations was discovered in Western Digital My Cloud Home, M...
The vulnerability in the web interface for managing Roxy-WI servers (previously HAProxy-WI) allows a attacker to gain unauthorized access to protected information.
The vulnerability in the web interface for managing Roxy-WI servers previously HAProxy-WI is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
